Firewalls have become a ubiquitous part of computer networks. Generally, firewalls can be viewed as combined hardware/software systems that reside at gateways between different networks, usually a private network (such as an enterprise's local area network or LAN) and the Internet. The firewall implements policies that determine which traffic can pass between the two networks, blocking access from one to the other when one or more of these policies are implicated. In many applications this policing is implemented at a proxy server.
At the minimum, a proxy server must relay requests in and out of the firewall to offer Internet access to computers inside the private network. This allows private network users to visit Internet Web sites. For most Web sites the information exchanged between the Internet host(s) and the private network client is passed unencrypted. Hence, the proxy is able to examine the information being passed and evaluate it against its firewall rules to determine whether or not the communications should be allowed.
Some communications, however, do not take place “in the clear”. Instead, communications between the private network client and the Internet host(s) are encrypted so as to prevent eavesdropping by third parties. Such encrypted communications are common in cases of Internet hosts involved with electronic commerce or banking, for example.
While the encryption of communications in these situations provides many benefits, one unfortunate consequence may be that proxy servers are not able to read the messages being passed. Hence, these proxies have no way of determining whether their firewall policies are being violated. This means that the private network clients may become vulnerable to attacks by computer viruses and other malware. It may also expose private network owners/operators to possible liability if traffic that otherwise would not have been permitted to pass through the firewall is allowed to pass.
One solution of course would be to permit the proxy to decrypt all transmissions between the private network client and the host and subject those decrypted communications to scrutiny according to the firewall policies just as if the original communications had not been encrypted. This is rather undesirable, however, inasmuch as it defeats the entire purpose of providing a secure communication mechanism for sensitive data. Once decrypted, the sensitive information may become an attractive target for attacks by third parties seeking to exploit such information to their advantage. In addition, even if other security measures were put in place to minimize the possibilities of success of such attacks, some users may simply object to the intrusion into their privacy. Imagine, for example, if users were told that their on-line banking transactions were going to be decrypted and subjected to such scrutiny against firewall policies. Many users would simply forgo such communications altogether rather than permit this exposure of their personal data, thereby becoming effectively deprived of what may be a very efficient way to conduct business.
Thus, what is needed is an effective way to police secure or encrypted communications between clients and hosts that does not require decryption of the message traffic.